| 1 | --- a/net/ipv4/netfilter/ip_tables.c |
| 2 | +++ b/net/ipv4/netfilter/ip_tables.c |
| 3 | @@ -309,6 +309,33 @@ struct ipt_entry *ipt_next_entry(const s |
| 4 | return (void *)entry + entry->next_offset; |
| 5 | } |
| 6 | |
| 7 | +static bool |
| 8 | +ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict) |
| 9 | +{ |
| 10 | + struct xt_entry_target *t; |
| 11 | + struct xt_standard_target *st; |
| 12 | + |
| 13 | + if (e->target_offset != sizeof(struct ipt_entry)) |
| 14 | + return false; |
| 15 | + |
| 16 | + if (!(e->ip.flags & IPT_F_NO_DEF_MATCH)) |
| 17 | + return false; |
| 18 | + |
| 19 | + t = ipt_get_target(e); |
| 20 | + if (t->u.kernel.target->target) |
| 21 | + return false; |
| 22 | + |
| 23 | + st = (struct xt_standard_target *) t; |
| 24 | + if (st->verdict == XT_RETURN) |
| 25 | + return false; |
| 26 | + |
| 27 | + if (st->verdict >= 0) |
| 28 | + return false; |
| 29 | + |
| 30 | + *verdict = (unsigned)(-st->verdict) - 1; |
| 31 | + return true; |
| 32 | +} |
| 33 | + |
| 34 | /* Returns one of the generic firewall policies, like NF_ACCEPT. */ |
| 35 | unsigned int |
| 36 | ipt_do_table(struct sk_buff *skb, |
| 37 | @@ -333,6 +360,25 @@ ipt_do_table(struct sk_buff *skb, |
| 38 | ip = ip_hdr(skb); |
| 39 | indev = in ? in->name : nulldevname; |
| 40 | outdev = out ? out->name : nulldevname; |
| 41 | + |
| 42 | + IP_NF_ASSERT(table->valid_hooks & (1 << hook)); |
| 43 | + local_bh_disable(); |
| 44 | + addend = xt_write_recseq_begin(); |
| 45 | + private = table->private; |
| 46 | + cpu = smp_processor_id(); |
| 47 | + table_base = private->entries[cpu]; |
| 48 | + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; |
| 49 | + stackptr = per_cpu_ptr(private->stackptr, cpu); |
| 50 | + origptr = *stackptr; |
| 51 | + |
| 52 | + e = get_entry(table_base, private->hook_entry[hook]); |
| 53 | + if (ipt_handle_default_rule(e, &verdict)) { |
| 54 | + ADD_COUNTER(e->counters, skb->len, 1); |
| 55 | + xt_write_recseq_end(addend); |
| 56 | + local_bh_enable(); |
| 57 | + return verdict; |
| 58 | + } |
| 59 | + |
| 60 | /* We handle fragments by dealing with the first fragment as |
| 61 | * if it was a normal packet. All other fragments are treated |
| 62 | * normally, except that they will NEVER match rules that ask |
| 63 | @@ -347,18 +393,6 @@ ipt_do_table(struct sk_buff *skb, |
| 64 | acpar.family = NFPROTO_IPV4; |
| 65 | acpar.hooknum = hook; |
| 66 | |
| 67 | - IP_NF_ASSERT(table->valid_hooks & (1 << hook)); |
| 68 | - local_bh_disable(); |
| 69 | - addend = xt_write_recseq_begin(); |
| 70 | - private = table->private; |
| 71 | - cpu = smp_processor_id(); |
| 72 | - table_base = private->entries[cpu]; |
| 73 | - jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; |
| 74 | - stackptr = per_cpu_ptr(private->stackptr, cpu); |
| 75 | - origptr = *stackptr; |
| 76 | - |
| 77 | - e = get_entry(table_base, private->hook_entry[hook]); |
| 78 | - |
| 79 | pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n", |
| 80 | table->name, hook, origptr, |
| 81 | get_entry(table_base, private->underflow[hook])); |
| 82 | |
